Re: [lamps] Interest to standardize PKI REST APIs?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 2019-06-07 22:00, Michael Richardson wrote:
> 
> Brockhaus, Hendrik <hendrik.brockhaus@siemens.com> wrote:
>> I think we need to first collect the required certificate
>> management use cases and check if they are addressed by existing
>> protocols.
> 
> I don't want to do that.  It's boiling the ocean.
> 
> I'm okay with making a list of RESTful APIs (proprietary ones, most
> of them have public specifications though), if only so that we know
> who to invite.
> 
>> Then I see two approaches: - Develop a new certificate management
>> protocol using standard functionality of REST frameworks and
>> learn from or even copy parts from existing protocols.
> 
> sure, but:
> https://www.explainxkcd.com/wiki/index.php/927:_Standards
> 
>> - Take an existing certificate management protocol, e.g. CMP,
>> adapt the transport to REST APIs and adapt the transaction
>> concept slightly to allow a state-less server.
> 
> I think that this is what we should do.

Thanks for the answers. The current protocol that is most "REST-like"
imho is EST, if not using the "fullcmc" functionality. You can
maneuver it with openssl and curl for the simple methods.
Some often required functions are missing, most notable revocation.

> 
>> As already said, I dislike to develop further certificate
>> management protocols. I think there are enough around already.
>> Therefor I would prefer the second approach. But finally the
>> solution must be acceptable to the target audience of developers
>> asking for REST APIs for certificate management.
> 
> Good, we agree :-)
> 
> -- Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software
> Works -= IPv6 IoT consulting =-
> 
> 
> _______________________________________________ Spasm mailing list 
> Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJc/TcqAAoJEGJtxJsAQ/5APu8H/i7mNEQ/GXMTiryQvKF+dB3q
HXqJyys1TPTgQ2FVEM25+CuG9J6WVrA89JsGbavs4epe7okdepRuImSYweB7DbTL
99V+IGnD9RHEfxtp1yGUOJU0DgBixy0Rp0vd6PDqQU62SMJ3tgtSbtI5B7YEdD0T
0aLJTSPAHzK38OCpIJJMJTs/gqSXogHwPPNiTZAncE4EXjiVMBEWaRSQJnO1mW6D
vN7nnDtM2pDuAkTtkqxfO2rBd88a+N7eZiEUtl9RRDOOpLiyrrTqPkqUhIUp6fpx
JqeupufpVPfuJYK9owFUmEm0ooL+Y3RgAZWPBbU8+D6D/kVlUcvYezGtROJCXV4=
=6QPi
-----END PGP SIGNATURE-----